Python

Python

FortiCNAPP supports Python across all our integrations and all interfaces involving our scanners.

The following provides a list of CWEs that the SAST scanners detect for Python:

CWE	Weakness Name
CWE-78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-95	Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-116	Improper Encoding or Escaping of Output
CWE-276	Incorrect Permission Assignment for Critical Resource
CWE-295	Improper Certificate Validation
CWE-326	Inadequate Encryption Strength
CWE-328	Use of Weak Hash
CWE-338	Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE-345	Insufficient Verification of Data Authenticity
CWE-346	Origin Validation Error
CWE-352	Cross-Site Request Forgery (CSRF)
CWE-502	Deserialization of Untrusted Data
CWE-523	Unprotected Transport of Credentials
CWE-614	Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-776	Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-1004	Sensitive Cookie Without 'HttpOnly' Flag
CWE-1275	Sensitive Cookie in HTTPS Session Without 'SameSite' Attribute (Not Official, Inferred)